I have been experiencing a memory leak when using pixel buffer objects to update textures. The leak seems to only occur on certain platforms with certain operating systems, and so we began to suspect the leak is occurring inside the Intel HD Series Windows 7 driver. Below is a summary of our testing on different platforms.

Can anyone tell if I'm doing something wrong in the code, or if this is potentially a driver leak?

Series 4 Chipset (Lenovo SL300), Windows XP SP3: No Leak

Series 4 Chipset (Lenovo SL300), Windows 7: Leaks ~500 kB/min

Intel HD Series (Lenovo X1), Windows 7: Leaks ~500 kB/min

Intel HD 3000 (11" MacBook Air) Mac OS 10.7.3: No Leak

Nvidia Quadro NVS, Windows XP: No Leak

Here is a stripped down version of the code to reproduce this issue (VS2008 project at http://www.viionsyst...k_Test_Case.zip). Extensive testing of this code shows no memory leaks detectable by VS2008's memory leak detector, yet GPU memory seems to grow indefinitely (according to ProcessExplorer).

int* pointer = 0; // creates an 8-byte pointer to an integer, pointer's value is 0 (Null-pointer) EDIT: yep it was unintialized...
int value = *pointer; // ERROR: you tried to access the contents of a null-pointer, this is illegal
pointer = new int; // dynamically (at runtime) assigns 4 bytes of memory at the place which is pointed by pointer, pointer is now valid
int value_2 = *pointer; // VALID: pointer actually points to somewhere, so value_2 should be either 0 or a random number, this depends on the compiler
delete pointer; // tells the operating system to free the place pointed by pointer
int value_3 = *pointer; // VALID: pointer still points to somewhere in the memory, and most probably you'll get back the old value pointed by pointer, since nothing has overwritten it. BUT this cannot be guaranteed (so DO NOT do this)
pointer = 0; // now pointer is a null-pointer again, but this doesn't free up any space, as opposed to delete
int value_4 = *pointer; //ERROR: you tried to access a null pointer again.
// for arrays you need to use this:
pointer = new int[32]; // allocate 32 integers (4 bytes per int) to the place pointed by pointer
//pointer will actually point to the first element of the array meaning this will be valid, and give a value:
int value_5 = *pointer; // VALID: gives back pointer[0]
delete [] pointer; //this frees up the space pointed by pointer, but pointer will still be valid, so you need to set it to 0
pointer = 0; // now pointer is a null-pointer again
// to check wether pointer is valid you can use a simple if
if(pointer) // if pointer is 0 (logical false) it will be invalid (null-pointer) else it will be valid
{
std::cout << "Pointer is valid.\n";
}
else
{
std::cout << "Pointer is INvalid.\n";
}

seems like you don't free your mappedBuf after using it. you need to do this if you want to really free some memory:

But we didn't allocate any memory here. What I understand is that after the call to glMapBuffer(), mappedBuf should be treated as GPU memory, so it's not up to us to free it. We copy the texture into this mapped memory, then call glUnmapBuffer() to indicate to OpenGL that we're done copying/modifying that buffer (the buffer that belongs to the driver, not us).

Just to be sure, I tried to delete[] mappedBuf now (before the statement where I set it to NULL). It crashes.

But we didn't allocate any memory here. What I understand is that after the call to glMapBuffer(), mappedBuf should be treated as GPU memory, so it's not up to us to free it. We copy the texture into this mapped memory, then call glUnmapBuffer() to indicate to OpenGL that we're done copying/modifying that buffer (the buffer that belongs to the driver, not us).

Any pointer in your code resides in CPU memory. The data contained within may come from GPU memory, but the pointer still needs to be declared in your code.

@Yours3!f - glMapBuffer doesn't work that way. I strongly suggest that you read the documentation for it. The "fix" you gave will actually crash the program (if you're lucky).@MarkS - the code does make sense. That's the way glMapBuffer works, and it's correct and in accordance with the documentation (aside from an extra unnecessary glBindBuffer which shouldn't be a cause of the observed leak).

@OP: have you tried this using glBufferSubData instead of glMapBuffer? It would be interesting to know if the same symptoms are observed with that. The following should be equivalent:

It appears that the gentleman thought C++ was extremely difficult and he was overjoyed that the machine was absorbing it; he understood that good C++ is difficult but the best C++ is well-nigh unintelligible.

seems like you don't free your mappedBuf after using it. you need to do this if you want to really free some memory:

The pointer returned by glMapBuffer shall not be deleted. It is a pointer to memory managed by OpenGL. The memory can be thought of as deleted by glUnmapBuffer, and he is correctly calling it once he's done.

this indicates you're not completely aware of how to use pointers.

Likewise, it shows that you are not thinking about every aspect of pointers; you shall only delete a pointer that you allocated.

The memcpy is copying img1 into mappedBuf and then you are setting mappedBuf to NULL. I suspect that you meant: memcpy(img1,mappedBuf,w * h * s);?

First of all, the target is an unpack buffer, which is a buffer you write to. Second, the buffer is mapped as write only. Third, he's copying from the image to the mapped buffer. Fourth, he's unmapping the buffer when he's done. Finally, he's creating a texture from the mapped buffer he just wrote to.

So the chain of commands lines up perfectly for writing to the mapped buffer and updating the texture.

Also, since you know that img1 and mappedBuf will be w * h * s bytes, and that mappedBuf is only used in this function, why not do this:

This, on the other hand, makes little sense. Reading from a write-to buffer target? Reading from write-only mapped memory? Allocating memory with new, only to overwrite the pointer the line after? Attempting to delete the pointer returned by glMapBuffer? The logical flow of the function makes little sense also by reading from a buffer and then creating a texture from the same buffer.

Thanks for the suggestion. I've tried your code, it works, but it doesn't fix the leak. I'm still seeing memory leaking at the same rate on the affected platforms.

That's interesting. Let's try to pin down which call is causing it. What happens if you comment out the glTexSubImage2D call? And if you comment out the glMapBuffer block (but leave glTexSubImage2D in and coming from the PBO)?

It appears that the gentleman thought C++ was extremely difficult and he was overjoyed that the machine was absorbing it; he understood that good C++ is difficult but the best C++ is well-nigh unintelligible.

Just to be sure, I tried to delete[] mappedBuf now (before the statement where I set it to NULL). It crashes.

ok, so I was wrong but still you're doing pretty intresting things with those pointers...

I tried to decypher what you're trying to do with the pointers so here it is:

img = 0img points to where texdata1 doesimg points to the write-only memory from where OGL will take back the texture datafill img with 0-scopy img-s content back to GPU (unmapping to pixelbufferhandle)since img points to the write-only memory of OGL, you make it point to texdata1fill mappedbuf with img (essentially texdata1)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

loop:img points to texdata1, so set it to texdata2fill mappedbuf with img (essentially texdata2)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

img points to texdata2, so set it to texdata1fill mappedbuf with img (essentially texdata1)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

the code essentially sets the texture to grey and white very fast, but with setting glutTimerFunc(5, timerCallback, 0); to glutTimerFunc(120, timerCallback, 0);I can clearly see this behaviour.

So next I tried to modify the source you've given (on Linux thanks for the portable code!) so that it makes more sense:

Just to be sure, I tried to delete[] mappedBuf now (before the statement where I set it to NULL). It crashes.

ok, so I was wrong but still you're doing pretty intresting things with those pointers...

I tried to decypher what you're trying to do with the pointers so here it is:

img = 0img points to where texdata1 doesimg points to the write-only memory from where OGL will take back the texture datafill img with 0-scopy img-s content back to GPU (unmapping to pixelbufferhandle)since img points to the write-only memory of OGL, you make it point to texdata1fill mappedbuf with img (essentially texdata1)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

loop:img points to texdata1, so set it to texdata2fill mappedbuf with img (essentially texdata2)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

img points to texdata2, so set it to texdata1fill mappedbuf with img (essentially texdata1)upload mappedbuf to GPU (unmapping to pixelbufferhandle)

the code essentially sets the texture to grey and white very fast, but with setting glutTimerFunc(5, timerCallback, 0); to glutTimerFunc(120, timerCallback, 0);I can clearly see this behaviour.

So next I tried to modify the source you've given (on Linux thanks for the portable code!) so that it makes more sense:

I don't know if the memory leak is still present with this version since I don't own an intel graphics card... could you please test this?

that should not work, you've kindof botched his original sample, you map the buffer in the initialization routine, but when modifying the pixel buffer, you unmap that pointer(and never map it again(or bind the correct pbo).)

glUnmapBuffer should be throwing errors pretty much after the first draw.

@Yours3!f - glMapBuffer doesn't work that way. I strongly suggest that you read the documentation for it. The "fix" you gave will actually crash the program (if you're lucky).@MarkS - the code does make sense. That's the way glMapBuffer works, and it's correct and in accordance with the documentation (aside from an extra unnecessary glBindBuffer which shouldn't be a cause of the observed leak).

@OP: have you tried this using glBufferSubData instead of glMapBuffer? It would be interesting to know if the same symptoms are observed with that. The following should be equivalent:

that should not work, you've kindof botched his original sample, you map the buffer in the initialization routine, but when modifying the pixel buffer, you unmap that pointer(and never map it again(or bind the correct pbo).)

glUnmapBuffer should be throwing errors pretty much after the first draw.

well it does work, glUnmapBuffer doesn't throw any errors if you add checking after it. It reproduces the same behaviour on Linux Mint 12.1 64 bit HD 5670 Catalyst 12.1

that should not work, you've kindof botched his original sample, you map the buffer in the initialization routine, but when modifying the pixel buffer, you unmap that pointer(and never map it again(or bind the correct pbo).)

glUnmapBuffer should be throwing errors pretty much after the first draw.

well it does work, glUnmapBuffer doesn't throw any errors if you add checking after it. It reproduces the same behaviour on Linux Mint 12.1 64 bit HD 5670 Catalyst 12.1

Try check its return value. In any case, here's what the specification has to say about double unmapping:

If the buffer data store is already in the unmapped state, UnmapBuffer returns FALSE, and an INVALID_OPERATION error is generated.

I have noticed before that error flags are not always set properly for error conditions when they should be according to the specification. I generally trust set flags to indicate an error, but I rarely trust a reset flag to indicate no error.

It is possible that the pointer returned by the mapping remains valid in your particular case as far as the memory mapper and the content of the buffer is concerned. It is not guaranteed in anyway by the specification though.

edit: And the relevant quote from the specification regarding unmapping the buffer:

Unmapping a mapped buffer object invalidates the pointer to its data store [...]

I hope the collision course I gave on pointers at least cleared some stuff in his head

i'm sorry, but he was doing nothing wrong in his initial code when it comes to pointers. and to be fair, he seems to have a better understanding then your "course"

for example:

int* pointer; // creates an 8-byte pointer to an integer, pointer's value is 0 (Null-pointer)
///////////This is not true, first of all, pointers generally are 4-bytes(although it isn't impossible for the architecture your working on to use 8-byte's for a pointer, generally they are only 4 bytes.)
//////////Secondly, not defining a value, does [B]NOT[/B] mean it defaults as a null pointer, it is simply undefined(do not rely on uninitialized pointers to equal 0, this is extremely bad practice.)
int value = *pointer; // ERROR: you tried to access the contents of a null-pointer, this is illegal
//again, not invalid, but is undefined behavior(generally seg-fault level, but it is not illegal by compilation to access a null pointer.)
pointer = new int; // dynamically (at runtime) assigns 4 bytes of memory at the place which is pointed by pointer, pointer is now valid
//pointer is not "now" valid, the assumption is that you were successful in creating the memory, but does not gurantee the returned data is valid(i.e: out of memory errors)
int value_2 = *pointer; // VALID: pointer actually points to somewhere, so value_2 should be either 0 or a random number, this depends on the compiler
//Yes, undefined behavior.
delete pointer; // tells the operating system to free the place pointed by pointer
//Assuming that the pointer was successfully created.
int value_3 = *pointer; // VALID: pointer still points to somewhere in the memory, and most probably you'll get back the old value pointed by pointer, since nothing has overwritten it. BUT this cannot be guaranteed (so DO NOT do this)
//Yes, undefined behavior.
pointer = 0; // now pointer is a null-pointer again, but this doesn't free up any space, as opposed to delete
//Yipee, finally, the pointer actually points to 0.
int value_4 = *pointer; //ERROR: you tried to access a null pointer again.
//No, not an Error, just undefiend attempt at reading w/e is written at the first address in ram.(this could be theoretically valid in some embedded systems.)
// for arrays you need to use this:
pointer = new int[32]; // allocate 32 integers (4 bytes per int) to the place pointed by pointer
//pointer will actually point to the first element of the array meaning this will be valid, and give a value:
int value_5 = *pointer; // VALID: gives back pointer[0]
delete [] pointer; //this frees up the space pointed by pointer, but pointer will still be valid, so you need to set it to 0
//pointer is pointing to undefined data after deletion.
pointer = 0; // now pointer is a null-pointer again
// to check wether pointer is valid you can use a simple if
if(pointer) // if pointer is 0 (logical false) it will be invalid (null-pointer) else it will be valid
//again, some embeded systems can use 0 as a logical address, as well, null does not always = 0, in 16/8 bit days, the processor did some near/far stuff with pointers, so do not assume null = 0
{
std::cout << "Pointer is valid.\n";
}
else
{
std::cout << "Pointer is INvalid.\n";
}

generally, my nitpick is with your first line, claiming that an uninitialized pointer is always 0 is wrong, it is UNDEFINED, never trust data that is uninitiated, and for suggesting that it well become 0 tells me your understanding of pointers/data structures is flawed.

well it does work, glUnmapBuffer doesn't throw any errors if you add checking after it. It reproduces the same behaviour on Linux Mint 12.1 64 bit HD 5670 Catalyst 12.1

as brother bob said, check the return value.

as per specifications, it should not work in the same way as OP describes. I can not tell you why it does, but it shouldn't.

I have noticed before that error flags are not always set properly for error conditions when they should be according to the specification. I generally trust set flags to indicate an error, but I rarely trust a reset flag to indicate no error.

i'm sorry, but he was doing nothing wrong in his initial code when it comes to pointers. and to be fair, he seems to have a better understanding then your "course"

for example:

int* pointer; // creates an 8-byte pointer to an integer, pointer's value is 0 (Null-pointer)
///////////This is not true, first of all, pointers generally are 4-bytes(although it isn't impossible for the architecture your working on to use 8-byte's for a pointer, generally they are only 4 bytes.)
//////////Secondly, not defining a value, does [B]NOT[/B] mean it defaults as a null pointer, it is simply undefined(do not rely on uninitialized pointers to equal 0, this is extremely bad practice.)
int value = *pointer; // ERROR: you tried to access the contents of a null-pointer, this is illegal
//again, not invalid, but is undefined behavior(generally seg-fault level, but it is not illegal by compilation to access a null pointer.)
pointer = new int; // dynamically (at runtime) assigns 4 bytes of memory at the place which is pointed by pointer, pointer is now valid
//pointer is not "now" valid, the assumption is that you were successful in creating the memory, but does not gurantee the returned data is valid(i.e: out of memory errors)
int value_2 = *pointer; // VALID: pointer actually points to somewhere, so value_2 should be either 0 or a random number, this depends on the compiler
//Yes, undefined behavior.
delete pointer; // tells the operating system to free the place pointed by pointer
//Assuming that the pointer was successfully created.
int value_3 = *pointer; // VALID: pointer still points to somewhere in the memory, and most probably you'll get back the old value pointed by pointer, since nothing has overwritten it. BUT this cannot be guaranteed (so DO NOT do this)
//Yes, undefined behavior.
pointer = 0; // now pointer is a null-pointer again, but this doesn't free up any space, as opposed to delete
//Yipee, finally, the pointer actually points to 0.
int value_4 = *pointer; //ERROR: you tried to access a null pointer again.
//No, not an Error, just undefiend attempt at reading w/e is written at the first address in ram.(this could be theoretically valid in some embedded systems.)
// for arrays you need to use this:
pointer = new int[32]; // allocate 32 integers (4 bytes per int) to the place pointed by pointer
//pointer will actually point to the first element of the array meaning this will be valid, and give a value:
int value_5 = *pointer; // VALID: gives back pointer[0]
delete [] pointer; //this frees up the space pointed by pointer, but pointer will still be valid, so you need to set it to 0
//pointer is pointing to undefined data after deletion.
pointer = 0; // now pointer is a null-pointer again
// to check wether pointer is valid you can use a simple if
if(pointer) // if pointer is 0 (logical false) it will be invalid (null-pointer) else it will be valid
//again, some embeded systems can use 0 as a logical address, as well, null does not always = 0, in 16/8 bit days, the processor did some near/far stuff with pointers, so do not assume null = 0
{
std::cout << "Pointer is valid.\n";
}
else
{
std::cout << "Pointer is INvalid.\n";
}

generally, my nitpick is with your first line, claiming that an uninitialized pointer is always 0 is wrong, it is UNDEFINED, never trust data that is uninitiated, and for suggesting that it well become 0 tells me your understanding of pointers/data structures is flawed.

you're right about the first line, 8 bytes is in fact platform specific but for 64 bit systems it should be 8 bytesand pointer declaration depends on the compiler (but you are right it should be undefined), for me this code works (with g++ on linux):

int* a;
if(a == 0)
{
std::cout << "A is 0.\n";
}

What I described should work using Visual C++ and g++ as well. I don't know about the embedded systems, so thanks for clarifying.

What I described should work using Visual C++ and g++ as well. I don't know about the embedded systems, so thanks for clarifying.

It works on neither Visual C++ nor g++. Or, rather, it works for the very same reason that your unmapped buffer appeared valid; undefined behavior. Try, for example, to enable optimization and see that happens.